wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 590387 - Crash [@ nsGenericHTMLFormElement::UpdateFormOwner] when attaching an element with @form set to an element which is not in a document. r=sicking a2.0=blocking

Browse Source 
--HG--
extra : rebase_source : 9f2a36b9a622c9ef1a2e3501ba45a297b8451d9e
This commit is contained in:
Mounir Lamouri 2010-08-25 22:45:43 +02:00
parent a41989b4f5
commit dd70db2b50
4 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
content/html/content/src/nsGenericHTMLElement.cpp
View File

@ -2483,7 +2483,14 @@ nsGenericHTMLFormElement::BindToTree(nsIDocument* aDocument,
NS_ENSURE_SUCCESS(rv, rv);
}
if (aParent || HasAttr(kNameSpaceID_None, nsGkAtoms::form)) {
// If @form is set, the element *has* to be in a document, otherwise it
// wouldn't be possible to find an element with the corresponding id.
// If @form isn't set, the element *has* to have a parent, otherwise it
// wouldn't be possible to find a form ancestor.
// We should not call UpdateFormOwner if none of these coniditions are
// fulfilled.
if (HasAttr(kNameSpaceID_None, nsGkAtoms::form) ? !!GetCurrentDoc()
: !!aParent) {
UpdateFormOwner(true, nsnull);
}
@ -2899,7 +2906,8 @@ nsGenericHTMLFormElement::UpdateFormOwner(bool aBindToTree,
NS_ASSERTION(GetCurrentDoc(), "The element should be in a document "
"when UpdateFormOwner is called!");
NS_ASSERTION(element == GetCurrentDoc()->GetElementById(formId),
NS_ASSERTION(!GetCurrentDoc() ||
element == GetCurrentDoc()->GetElementById(formId),
"element should be equals to the current element "
"associated with the id in @form!");

3
content/html/content/src/nsGenericHTMLElement.h
View File

@ -874,6 +874,9 @@ protected:
* @param aFormIdElement The element associated with the id in @form. If
* aBindToTree is false, aFormIdElement *must* contain the element associated
* with the id in @form. Otherwise, it *must* be null.
*
* @note Callers of UpdateFormOwner have to be sure the element is in a
* document (GetCurrentDoc() != nsnull).
*/
void UpdateFormOwner(bool aBindToTree, Element* aFormIdElement);

8
layout/generic/crashtests/590387.html Normal file
View File

@ -0,0 +1,8 @@
<!DOCTYPE html>
<html>
<head>
<script>
document.createElement("div").innerHTML = "<output form=x>";
</script>
</head>
</html>

1
layout/generic/crashtests/crashtests.list
View File

@ -333,3 +333,4 @@ load 586806-1.html
load 586806-2.html
load 586806-3.html
load 586973-1.html
load 590387.html